Free check, instantly on screen

DMARC check: is your domain open to phishing in your name?

An attacker who wants to send mail in your domain's name first looks at three DNS records. This check does the same: SPF, DMARC and MX, a sample of DKIM, and MTA-STS and DANE, straight from DNS, with the explanation and the standard for each record.

Your own domain only: we check the main domain after the @ of your business e-mail address. The address itself is not stored and you will not receive any mail.

One check that only reads, at the moment you press the button. Address, domain and result are not kept.

What the check does

  • Whether an SPF record exists, whether there is exactly one, how it ends (-all, ~all, +all) and how many DNS lookups the record itself already costs (the limit is ten).
  • Whether a DMARC record exists, which policy it applies (none, quarantine, reject) and whether a reporting address (rua) is set.
  • Whether the domain receives mail (MX or null MX), whether DKIM can be found on common selectors and whether MTA-STS or DANE is set.

What this check does not do

  • DKIM with your own selector: the sample looks at common selectors; no find is not a finding.
  • The includes in your SPF record are not followed; the DNS lookup count is a lower bound.
  • The MTA-STS policy file is not fetched and DNSSEC is not checked; internet.nl does check DNSSEC.

Why only your own domain

The check runs on the main domain behind your business e-mail address. That is a threshold against looking up someone else's domain, in line with our acceptable use policy that you only check domains you own or are authorised to manage. The check only reads: a DNS lookup, a few connections, one page fetch, what a mail server or browser sees too.

What the result means

SPF says which servers may send on behalf of your domain, DKIM puts a cryptographic signature under every mail, and DMARC ties both to the sender address and tells the receiver what to do with deviating mail. Without DMARC a receiver cannot tie what SPF and DKIM say to the sender address the reader sees; without SPF and DKIM, DMARC has nothing to build on. With one of the two it already works, with both it is robust.

A DMARC policy of p=none is a start: you receive reports, but DMARC then does not stop phishing in your name; whether it arrives is up to the receiver. Only p=quarantine or p=reject makes the policy do something. A domain that never sends mail needs SPF and DMARC too; otherwise that very domain is a willing sender for an attacker.

How the three records work together, with example records and the blind spot of domains that never send mail, is in SPF, DKIM and DMARC explained.

This is a single snapshot

A record that is correct today breaks at the next DNS migration; a certificate expires silently. The free security scan looks more broadly at what your domain exposes to the internet, and the knowledge base explains what a free check does and does not show.

Also check: certificate and TLS · security headers

Further reading